Add setting to disallow insecure transports

[See original issue on GitLab](https://gitlab.com/BuildStream/buildstream/-/issues/408)
In GitLab by [[Gitlab user @TheRealMichaelCatanzaro]](https://gitlab.com/TheRealMichaelCatanzaro) on May 28, 2018, 14:49

## Background

For GNOME, we should have a setting to disable all insecure transports. http://, ftp://, git:// etc. Basically, anything that is not https:// should fail. Ideally BuildStream would notice when beginning a build that an insecure URL has been added to the project and refuse to build anything, but it's fine as long as it fails at some point.

It should apply cross-junction, so e.g. if the freedesktop SDK adds an element that uses a http:// URI, that should fail rather than downloading anything via http://.

## Task description

[//]: # (Short summary of the action to be executed)

* [ ] Action 1
* [ ] Action 2
* [ ] Action 3

## Acceptance Criteria

Should be able to add a setting to project.refs to disable insecure transports

----

Start from the project.refs configuration and the code that validates or fetches project and junction sources. Trace where transport URLs are checked, including cross-junction sources. Done means a project setting can reject insecure transports such as http://, ftp://, and git:// before anything is downloaded.

Written by the indexing model from the issue text.